The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion

Re:The CNAME of the Game: Large-scale Analysis of DNS-based ... by thrwwy0304 on Friday March 05, 2021 @02:57PM (#26361310)

Trying my best! This is really confusing stuff, and I probably shouldn't have come out so hot with "This is false." Safari's rollout of ITP broke my company's code three times over, so I've been in the weeds on this for a while.

I think you're missing that setting cookies alone isn't what allowed evil.com to sync identities. They needed to set the cookie from one site, and receive that same cookie when the user visited a different site.

With CNAME cloaking, it's true that EvilCo can set cookies on both evil.foo.com and evil.bar.com. But when a user is on evil.foo.com, there's no way to make a request to evil.bar.com that includes evil.bar.com's cookies. This is the mechanism that stops syncing identities.

Does that help?

[ Parent | on HN ]

Re:The CNAME of the Game: Large-scale Analysis of DNS-based ... by jrochkind1 on Friday March 05, 2021 @10:15PM (#26364876)

OK, so here's the basic issue.

What did banning third-party cookies actually stop then? Nothing?

So whatever they were able to do before banning third-party cookies, why did banning third-party cookies matter at all?

The whole point of the CNAME as described is to get around third-party cookie bans. If getting around the third-party cookie ban doesn't actually help -- that seems to suggest the third-party cookie ban in the first place didn't actually do anything, if getting around it doesn't give you anything? no?

[ Parent | on HN ]

Re:The CNAME of the Game: Large-scale Analysis of DNS-based ... by thrwwy0304 on Sunday March 07, 2021 @09:37AM (#26376129)

It stopped syncing identities with the first-class web APIs, and forced trackers to use browser fingerprinting.

That _does_ help. It adds noise to things and helps us shift our focus to stopping fingerprinting.

[ Parent | on HN ]